v0.9.0

0.9.0 (2026-08-21)

Features

• security: derive secret verifiers with Argon2id from page-backed memory (#915) (4667bb8), closes #272
• security: enforce the ~77-bit boot-secret floor at first-boot setup (#912) (f071f42)
• watchdog: pet only while every liveness owner is still advancing (#920) (33791a8), closes #875

Bug Fixes

• ci: count the ledger's runnable tests after combining profiles, not before (#916) (653e0df), closes #855
• clock: separate authentication from precedence and refuse implausible time (#906) (b7f9205)
• crypto: enable zeroize on every keyed cipher crate and prove it at compile time (#900) (e2218fc)
• csprng: credit cadence departure, not raw sample-to-sample bit flips (#901) (7b01d75)
• kernel: map the whole reserved window, and derive its bound from one place (#918) (25ccf87), closes #917
• klesis-core: reject an out-of-domain CSQ reading and cover the six untested guards (#909) (1f174d6)
• krypta: hold ratchet key material in a type whose drop scrubs it (#904) (0c7f6df)
• krypta: make the ratchet commit atomic and stop it being duplicable (#908) (dd3ba99)
• matrix_crypto: drop the Olm ratchet fields nothing can advance, scrub what the handshake used (#903) (d733857)
• matrix_crypto: name the Olm pre-key derivation for what it is (#913) (8c217c2)
• pteron: close the four remaining SMP findings (#910) (e96b7c7)
• security_mode: store a versioned Sentinel-exit PIN verifier with a per-device salt (#896) (bbf9c86)
• security: delete the plaintext LFS mount rather than gate it (#919) (cff4e35), closes #866
• security: gate radio-affecting threat action on calibration and authorization (#921) (c9562fd)
• security: require a real provisioning anchor, or carry none at all (#922) (a5016e8)
• security: verify every stored secret through one salted, iterated record (#898) (b5cb2c2)
• sms: apply the SCTS timezone octet so decoded timestamps are UTC (#905) (ad048fe)
• stegnos: reject a persisted PBKDF2 iteration count above the maximum (#899) (87fdfad)
• thumos: close all eight findings in the low-severity kernel batch (#911) (8160589)
• thumos: close the three live findings in the wave-1 batch (#907) (891da7e)